CVE-2026-2792
Published: 24 February 2026
Description
Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to…
more
run arbitrary code. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely remediation of flaws like the memory safety bugs in CVE-2026-2792 by applying patches released in updated Firefox and Thunderbird versions.
Provides memory protections such as address space layout randomization and data execution prevention to block exploitation of memory corruption from out-of-bounds writes in affected browsers.
Enforces process isolation and sandboxing in browsers to limit the impact of arbitrary code execution resulting from memory safety vulnerabilities like CVE-2026-2792.
Security SummaryAI
CVE-2026-2792 involves multiple memory safety bugs, classified under CWE-787 (Out-of-bounds Write), present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147. These bugs exhibited evidence of memory corruption, which Mozilla presumes could be exploited with sufficient effort to achieve arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 9.8, reflecting its critical severity.
Attackers can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), potentially leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). Any unauthenticated remote attacker could target affected browsers or email clients to corrupt memory and, with advanced techniques, execute arbitrary code within the victim's context.
Mozilla's security advisories (MFSA 2026-13, 15, 16, and 17) detail the fixes applied in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Users should update to these patched versions to mitigate the risks, as referenced in the associated Bugzilla entries.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption RCE in client apps (Firefox/Thunderbird) with no user interaction directly enables T1203 Exploitation for Client Execution.